CVE-2026-101967: Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.2R2-S5.6-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2X100-D35-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4X300-D40-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R1-S2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R2-EVO - Upgrade
Upgrade
Juniper Networks Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.4R1-EVO
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Juniper Networks Junos OS Evolved PTX Series devices are exposed when zero-touch provisioning is used and an attacker can reach the management LAN.
What does an attacker need to exploit the vulnerability?
The attacker does not need authentication or user interaction. They need the ability to provide a crafted DHCP response on the management LAN during zero-touch provisioning.
What is the impact of successful exploitation?
A successful exploit allows execution of operating-system commands as root, affecting confidentiality, integrity, and availability.
What can be done if patching is not immediately possible?
The provided information identifies zero-touch provisioning and management-LAN DHCP responses as the attack path. Restricting untrusted access to the management LAN and preventing attacker-controlled DHCP responses from reaching provisioning devices would address that exposure.